hunt-business-logic

Map authentication boundaries, enumerate verification flows, test rate limits with header rotation, and intercept payment flows with Burp Suite to tamper with amounts and currencies. Validate each finding against concrete financial or privacy impact before reporting.

Rotate X-Forwarded-For, X-Real-IP, True-Client-IP, and CF-Connecting-IP headers per request while sending rapid POST requests. Servers that read client IP from these spoofable headers instead of the connection IP can be bypassed trivially.

Common techniques include modifying in-flight amount fields to $0.01, swapping to lower-value currencies, submitting negative item quantities, and replaying archived price IDs mid-checkout. Also test whether payment webhooks validate HMAC signatures before crediting orders.

Yes, when verification is enforced only in the UI. Call the post-verification API endpoint directly with an unverified session, or replay a valid verification token against a different account to check for server-side enforcement gaps.

Reject findings that lack concrete attacker capability, identifiable victim loss, or reproducibility. Apply the Gate 0 check: if you cannot demonstrate financial loss, unauthorized access, or privacy impact end-to-end in under 10 minutes, refine the methodology first.